AMENDMENTS TO THE CLAIMS 



Claims 1-13, 25-31, and 33 are cancelled. 
No claims are added. 
5 Claims 14, 17, 24, and 32 are amended. 
Claims 14-24 and 32 are pending. 

1-13. (Cancelled) 

10 14. (Currently amended) A system for maintaining records of events 
comprising: 

an event receiver module, configured to receive an event that contains, 
respectively, an event identification indicator and strings containing event fields 
each specifying a different componen t aspects aspect of the event; and 
15 an event-processing module, configured to reference an event definition 

table to determine locations of event fields In the event, and store the event 
fields in a record of a database according to the different component asp e ct 
aspects specified by the event field. 

20 15. (Original) The system as recited In Claim 14, further comprising a 
computer that maintains the event receiver module and the event-processing 
module. 
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16. (Original) The system as recited in Claim 14, further comprising a client 
computer that performs certain actions that are recorded as an event. 

17. (Currently amended) The system as recited in Claim 14, wherein on e or 
5 m©fe-the event pertains to a security sensitive transaction. 

18. (Original) The system as recited in Claim 14, vi/herein one or more of the 
event fields pertain to a client logging-on to a network. 

10 19. (Original) The system as recited In Claim 14, wherein one or more of the 
event fields pertain to a client opening a file. 

20. (Original) The system as recited in Claim 14, wherein one or more of the 
event fields pertain to a client performing certain application level tasks. 

15 

21 . (Original) The system as recited in Claim 14, wherein one or more of the 
event fields pertain to a client administering passwords. 

22. (Original) The system as recited in Claim 14, wherein one or more of the 
20 event fields pertain to a client changing passwords. 

23. (Original) The system as recited in Claim 14, wherein one or more of the 
event fields pertain to a client accessing a particular object. 
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24. (Currently amended) The system as recited in Claim 14, further 
comprising a definition-module, configured to generate a definition table by: 

selecting one or more specific types of event field s from a e v e n t from an 
5 event schema; 

ascertaining locations of the specific types of event fields in the event 
schema; and 

storing the locations of the specific types of event fields in the definition 

table. 

10 

26-31. (Cancelled) 
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32. (Currently amended) One or more computer-readable media as r e cit e d 
i n Claim 31, further comprising computer executable instructions that, when 
executed, direct a computer to: 

generate events that contain, respectively, an event identification and 
5 one or more event descriptions, the event descriptions containing one or more 
values in the event fields, and store the events strings in a log when a security 
sensitive event is oerformed: 

the comput e r to parse the event descriptions to Identify one or more 
values In the event fields : and 
10 store the events in a database in a manner to enable values in the event 

fields to be independently searched through the use of an event definition table 
containing mappings of the event descriptions for each event identification, the 
mappings including the locations of one or more values in the event fields 
contained within the event descriptions . 

15 

33. (Cancelled) 



lee^hayes 



9 



1214051045 3T5142.DOC 



